Intrusion the act of wrongfully entering upon, seizing, or taking possession of property owned and/or operated by others.

learn more… | top users | synonyms

3
votes
1answer
140 views

Monitoring an uninvited guest on my WLAN? [duplicate]

At home I configured a common, residential, consumer-grade wireless network. It is build from a Broadcom router connecting a few personal devices (i.e. my laptop & smartphone) to the Internet. My ...
2
votes
1answer
83 views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
1
vote
3answers
66 views

MAC address of source in RDP session

In a forensic analysis I analyzed the event logs of the affected machine and saw various RDP sessions from XYZ IP address. However to prove that the source IP was not spoofed is it possible that I ...
2
votes
1answer
53 views

Counting on firewalls only : sound security strategy to prevent intrusion?

I had this discussion with a friend of mine who is a windows sysadmin. He said to me that for his company's IT security, he is doing only updates on the windows server. But except these system ...
-4
votes
3answers
113 views

Is there a way to secure a Linux machine in a way that no one else (but me) can access its contents? [closed]

And I mean, even if someone tries rooting with a Live CD, even if one takes the HDD away and plug it in somewhere else, etc... I want to be able to give a client a machine with a service running, but ...
4
votes
1answer
73 views

Detect PC Boot from Live CD

is it possible to detect a boot-up via live CD (eg. Ubuntu, Debian, Tails ...) that happened in the past? If yes, where can this information be obtained? I suspect my PC has been booted through a ...
1
vote
2answers
91 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
-1
votes
1answer
30 views

Host Based IDS with syscall monitoring

Hey Guys I am a newbie in security stuff and now I am working on my final project about host based IDS. I have some questions to you guys Can a rootkit be classified as an intrusion or is it a ...
1
vote
0answers
116 views

SSH intrusion suspected: Logwatch report versus SSH log file entries

My Web server's Logwatch report shows ssh and su activity that should not be there: sshd: Sessions Opened: deployer: 45 Time(s) su: Sessions Opened: root -> deployer: 8 Time(s) ...
2
votes
1answer
128 views

How easily will the vBulleting data from vBulletin and Foxit be cracked? What data is at risk? How was it encryted?

vBulletin Solutions and Foxit Software were breached. The culprit (ColdZer0 or Coldroot) claims to have data from 479,895 vBulletin Service and Foxit Software accounts that include identifiers, ...
1
vote
0answers
43 views

How many accounts are affected by the vBulletin breach? At risk? [closed]

vBulletin hack(s) have affected vBulletin, itself (security questions and answers, salts, and hashes of more than 300,000 users of the 345k known to be registered), and Foxit Software (some data for ...
1
vote
2answers
46 views

Access LAN services through malicious web page

Suppose that a user on a corporate network has access to a private FTP server, or intranet site, that's only available on the Local Area Network, available at http://internal.example.com. If an ...
2
votes
0answers
42 views

Priming an IDS/IPS for an impending attack

Is there a system which can put an IDS/IPS in "high alert" mode if there information about a suspected impending attack in the near future (obtained from an external system)? I would like to know if ...
4
votes
2answers
151 views

What is a “roving” backdoor?

What is a "roving" backdoor? I understand the general concept of a backdoor. Emphasis on keyword qualifier: "roving"...
0
votes
1answer
72 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
1
vote
1answer
131 views

kernel: Intrusion disconnecting me

I've read about it a little but I'm concerned. It never happened before and for last 5 hours my router gets kernel: Intrusion alerts similar to these: As soon as the kernel: Intrusion is detected, ...
3
votes
0answers
181 views

Help locate “snot” IPS/IDS testing tool? [closed]

It seems this great tool has been lost to internet backlog somewhere. I cannot locate it anywhere. The description of tools provided is http://www.securityfocus.com/tools/category/112 If someone on ...
1
vote
3answers
432 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
1
vote
0answers
145 views

How to test OSSEC HIDS using a linux dataset containing raw system call traces?

I have been tasked to test effectiveness of OSSEC HIDS (by effectiveness I mean detection rate it achieves as well as false positives rate) when a dataset of raw system call traces are used. The ...
-1
votes
2answers
1k views

What are security risks of connecting to my home vpn from my work?

I connected to my home-made VPN, which uses OpenVPN and 2048bits encryption keys, from my work. What are the security risks of doing so, given the fact that the servers are in the same network my ...
13
votes
3answers
809 views

Drupal server compromised - I want to investigate the attack technique / compromise

I've got a drupal site running on an up to date CentOS 7 LAMP AWS EC2 instance (freshly installed a couple of months ago) and I've just found out that somehow, probably through a poorly coded 3rd ...
3
votes
1answer
196 views

How to detect when your RAM is being copied or scanned by a hypervisor

I am working in a Virtual Machine that is on a ESXi server on a remote machine. I am not the only one who has access to the ESXi and others could take memory snapshots of my running VM. Is there a way ...
4
votes
1answer
1k views

Snort even though working properly does not report majority of rules

I have installed Snort 2.9.7.0 and it does not detect majority of attacks, such as nmap port scans, downloading exe files, opening documents containing keyword "root". I use Snort together with ...
2
votes
1answer
639 views

kernel: Intrusion IN=ppp0 on my Fairpoint assigned router from IP in China

I'm getting these user alerts: kernel: Intrusion -> IN=ppp0 OUT= MAC= SRC=115.230.125.147 DST=xx.xxx.xxx.xxx LEN=40 TOS=0x08 PREC=0x20 TTL=107 ID=256 PROTO=TCP SPT=64316 DPT=9064 WINDOW=15500 RES=...
0
votes
1answer
248 views

Puzzle: network intrusion or OpenDNS/Disconnect.me collision?

My home / home-office network uses OpenDNS as a content filter. As the OpenDNS admin, I received a "User wants access to..." email indicating that someone tried to access a blocked site and requested ...
7
votes
2answers
558 views

How exactly was Sony Pictures hacked November 2014? [closed]

There is lots of media coverage like this one but I have not yet been able to find details on how the hackers got into the network, the servers and the users' systems. So what vulnerabilities / zero-...
0
votes
3answers
2k views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
0
votes
1answer
66 views

cd-rom distro — plus additional validation

dear security experts: we would like to create a very safe webserver. we are in awe at the sophistication and complexity of many solutions, but they don't apply to us. we are a small shop. by safe,...
0
votes
1answer
55 views

What to do when a Linux account gets owned?

What is the best course of action when you discover that a non-administrator Linux account has gotten owned, and a single foreign process is running, making all sorts of networking connections? For ...
3
votes
3answers
210 views

Can closed, sleeping MacBook send network data?

I would think the answer is unequivocally, "No." But... My MacBook Pro logged "Diagnostic and Usage Messages" in the Console, at 4:19am, while it was physically closed and (therefore) sleeping. I was ...
2
votes
2answers
270 views

Intrusion Detected - OS Attack

I have recently gotten a prompt from my anti virus stating that there was an intrusion with an OS attack as describe in the link below: http://www.symantec.com/security_response/attacksignatures/...
3
votes
4answers
99 views

What kinds of attacks would be missed if we don't look at both host and network activity

Suppose I have both network based IDS and host based IDS installed in my environment, will I miss any security attacks if I don't correlate the information from these sources? If so, what are they? It ...
-1
votes
1answer
704 views

My cookies have been stolen. What to do?

About a month and a half ago I got infected by a virus called MSIL.Bladabindi. I noticed the virus quite soon because google notified me that someone from Turkey tried to access my account (I'm in ...
1
vote
0answers
172 views

Browser version 0.0 in visitor logs [closed]

I am seeing quite a few browser "version 0.0" in visitor log. Can anyone explain the significance of this? Please see examples below. Thanks. Safari version 0.0 running on ChromeOS Chrome version 0....
6
votes
4answers
2k views

Suggestions to avoid cookie-hijacking in a web application

I've been developing web-apps for quite some time now. While making websites, the "remember me" feature is one of the most trivial(read as must-have-for-clients) feature to be implemented. Until today,...
1
vote
1answer
90 views

Help with successful Internal intrusions

I'm requesting some help with a particular breach of access that we've experienced in our environment. the attacker is an internal employee who has made a few notes about the environment that I ...
4
votes
1answer
3k views

Intrusion prevention in windows azure?

When using the Windows Azure IAAS servers how does one setup IPS for all incoming traffic to these servers? How would a regular user who runs his whole environment within Azure make sure that he can ...
0
votes
2answers
116 views

Statistics about Significant security breaches in 2013 [closed]

I am curious in general if there are any reporting that collects statistics about the security breaches? like per country per industry and revenue losses? I am not interested in anonymized breaches ...
0
votes
1answer
392 views

IDS false positive rates

Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at ...
0
votes
2answers
286 views

PC showed evidence of a phone being attached for no obvious reason. Theories on why? [closed]

Connecting via remote desktop to a Windows 7 machine today showed the last couple of seconds of a windows device installing and the "Your device is ready" popup for a Sony Xperia T. Going to printers/...
1
vote
2answers
370 views

Identify users accessing hidden link in a website

Recently I put some hidden links in a web site in order to trap web crawlers. (Used CSS visibility hidden style in order to avoid human users accessing it). Any way, I found that there were plenty of ...
0
votes
3answers
807 views

Why there are uninvited incoming packets to my ADSL connection?

To verify this, I boot my PC from Kali Linux live distro. Before establishing ADSL/PPP connection, I start Wireshark and listen on any pseudo device. Then I create the connection to ISP network. ...
-1
votes
1answer
337 views

Can we identify if someone is keeping an eye on our computer usage?

For some reason I had been using public network for a small time, and I suspect that someone was actually watching/recording my online/offline activities. At some time I suspected that someone was ...
-1
votes
1answer
80 views

Network and data security for small online businesses? [closed]

What is the most efficient way of protecting small online business from outside threats. Everything too much expensive is not a solution. I've been looking for good web application firewall and at ...
1
vote
3answers
450 views

How to check if our clients were compromised by security breaches in other web applications?

Every now and then a known website is hacked, such as what happened to Adobe or Cupid Media. In such incidents user data is leaked, including usernames, encrypted (and sometimes plain text!) passwords....
1
vote
2answers
235 views

How to properly configure OSSEC for Web Application Security ?

I would like to implement OSSEC as HIDS on my server, but by default OSSIC monitors a number of folders. I am going to deploy a web application on my server. So what should be my default OSSEC ...
1
vote
3answers
362 views

How did Snowden do it? [closed]

We've all read about how Edward Snowden got access to thousands of classified documents and shared them with reporters. But how did he do it? He got access to tons of documents that he was not ...
0
votes
2answers
1k views

Could my computer be infiltrated if someone knows my external IP? [closed]

Could my computer be compromised if someone knew my external IP? I know that when you type that in it just goes into the router page, but my computer is connected to said router. If so, what is the ...
18
votes
7answers
2k views

Defence Against Keyboard Keylogger

I am wondering whether there is a way to defend against USB Keyboard Keylogger (obviously other than physically checking the keyboard every time after leaving my computer unattended). These days, ...
3
votes
4answers
283 views

To disconnect or not disconnect an intruder?

Most of the time, when an intruder is detected, we would disconnect it at once. However there are certain cases where the intruder is not disconnected. What are the benefits of not disconnecting the ...